The response seems to include all the required headers per this document. On the other hand, and per this header “ Access-Control-Allow-Origin:”, you are using cross-origin resource sharing (CORS). If you have not configured it on Google Cloud Storage as instructed in this document, it could be the reason it is not caching. One other possibility, and since you are using a query in the URL, you may have customized Cache Keys by excluding a component and as explained in these documents [1] [2]. You my also try to invalidate Cache as it seems that your max-age is set to a year and maybe reducing max-age to an hour (3600) as to debug may help.
For further help, and since it is a technical query, I suggest posting your question on serverfault.com. Please include the CORS policy, and explain your use-case as to help the community debug. I hope the above helps.
I checked the http headers with the guide,the http Vary header can only be: Accept, Accept-Encoding, or Origin, but based on your curl output, your http Vary head include: X-Forwarded-Proto,User-Agent, which is not in the list.
You can remove the two parameters in the Vary header, and try again.
For further help, and since it is a technical query, I suggest posting your question on serverfault.com. I hope the above helps.